System and method of facilitating the identification of a computer on a network

ABSTRACT

A system and method for facilitating identification of an attacking computer in a network is provided. A user attempting to login to a network application may be presented with a screen prior to the login which lists preconditions of gaining access to the application. If a user concurs with the preconditions, a security module is downloaded to the user&#39;s computer and executed which gathers various configuration settings and transmits the gathered information to a predetermined destination. The security module may also attempt to place a call to a predetermined destination over a modem in the computer to cause registration of caller-ID data when answered at the predetermined destination. Once the security check is completed, login may proceed with the network application. Any data gathered by the security module may be stored for later recall and use to identify the computer in the event of an attack.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is a continuation application of co-pending U.S.application Ser. No. 11/011,869, filed on Dec. 14, 2004, the contents ofwhich are incorporated by reference in its entirety herein.

FIELD OF THE INVENTION

The invention generally relates to a system and method for identifying acomputer that may be involved in an attack on a network application and,more particularly, to a system and method to accumulate identifyingcharacteristics of a computer prior to a login to the networkapplication.

BACKGROUND DESCRIPTION

The identification of a computer that has attacked a business orgovernmental network application may be of paramount importance forprevention of unauthorized attacks and for law enforcement purposes, ifrequired. Computer attacks with intentions to access or destroyinformation, whether the information is secured or not, continues to bea major issue for computerized operations.

Controlling access to databases or services typically includes levels ofpassword security or authentication procedures to exclude unauthorizedaccess. However, even with these security measures, attacks arefrequently successful. Once an attack has occurred, reconstructinginformation related to the intrusion may be then difficult, if notimpossible.

In a situation when the attack may be aimed at gaining access to thesystem, as opposed to “denial of service” type of attack, identificationof the attacker may be impeded by at least the following circumstances:

(i) the fact that immediately before attempting the attack, when thelogin screen is requested and displayed, the potential intruder may notbe distinguished from the legitimate application user, and

(ii) at the moment when the system may be able to classify the accessattempt as being a possible attack, rather than a legitimate login, theattacker often has already been warned, e.g., by an “Invalid userID” or“Invalid Password” message. The attacker may be either gone or on ahigher alert level, so it may be too late to take steps aimed atidentifying the attacking computer.

Currently, capturing identifying information of a potential intruder,before or concurrent with a network access, does not exist. If suchidentifying information and specific connection related data were to beaccumulated, stored and catalogued then a basis for reconstructing theidentity of an attacker may be possible. Once identifying informationhas been captured, legal recourse may be more easily accomplished.

SUMMARY OF THE INVENTION

In an aspect of the invention, a method is provided for facilitatingidentification in a network. The method comprises the steps ofprocessing a login to an application only after capturing configurationdata of a computer performing the login, recalling the configurationdata and matching at least portions of the recalled configuration datato corresponding portions of subsequent captured configuration data toestablish whether the recalled configuration data and the subsequentcaptured configuration data are both derived from the computer.

In another aspect of the invention, a system for facilitating attackeridentification in a network is provided. The system comprises at leastone component to process a login to an application only after capturingconfiguration data of a computer performing the login, recall theconfiguration data and match at least portions of the recalledconfiguration data to corresponding portions of subsequent capturedconfiguration data to establish whether the recalled configuration dataand the subsequent captured configuration data are both derived from thecomputer.

In another aspect of the invention, a computer program product isprovided comprising a computer usable medium having readable programcode embodied in the medium, the computer program product includes atleast one component to process a login to an application only aftercapturing configuration data of a computer performing the login, recallthe configuration data and match at least portions of the recalledconfiguration data to corresponding portions of subsequent capturedconfiguration data to establish whether the recalled configuration dataand the subsequent captured configuration data are both derived from thecomputer.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an illustrative embodiment of components of the invention;

FIG. 2 is an illustration of an exemplary security graphical userinterface (GUI) of the invention;

FIG. 3 is a flow diagram showing an embodiment of steps of using theinvention; and

FIG. 4 is a flow diagram of an embodiment showing steps of using theinvention.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION

This invention is directed to a system and method for capturing computerinformation prior to processing a login of a user to a network basedapplication or system. Based on the captured information, recourse maybe taken if any illicit activity during or after login is detected. Theinvention may provide increased security aspects for businessapplications which are regarded as being security sensitive. This may beanalogous to security arrangements applicable to human visitors ofhigh-security facilities, e.g., airports, where all the customersconsent to bag and personal search as a condition of accessing thedeparture zone.

FIG. 1 is an illustrative embodiment showing components of theinvention, generally denoted by reference numeral 100. The components100 include one or more computers or computing devices such as apersonal computer (PC) 105 connected to network 110 which may be theInternet, wide-area network (LAN), or local area network (LAN).Optionally, a modem may be a part of the PC 105 which may be connectedto a telephone network 135 for placing security calls to server 115. Inembodiments, accordingly, there may be more than one server (i.e., 1−N)and more than one database (i.e., 1−N) in a wide range ofconfigurations, perhaps using various modes of connectivity, as one ofordinary skill in the art would recognize.

The components 100 also include server 115 which may be more than oneserver (1−N) and represents a platform that serves one or moreapplications 130 to users. The applications may be of various types suchas, for example, financial, ordering, searching, information retrieval,or the like. The server 115 may be in communication with the database120, which may be more than one database (1−N), for storing applicationsand/or for storing information collected by components of the invention.Also included is a security module 125, generally known as “hostage.exe”which may also be resident, at least in part, on server 115 and whichmay be downloaded to the PC 105 and executed when the PC 105 accesses anapplication on the network 110. The security program 125 may storecollected user information in database 120, or similar database. Thesecurity module is typically an executable module (e.g., compiled Cprogram, or the like) capable of running on a client platform (e.g.,Windows®, Linux®, or the like). Additionally, the applications andsecurity module 125 may be served by different servers, as appropriate.As such, the components 100 are meant to be illustrative and not limitedto any particular topology or configuration.

Further, the security module may take on various forms for use bynetworks, applications, or systems as appropriate for the specificenvironment of use, including browser operations. According to thesystem of method of the invention, the login screen may now be deferred,and instead, the network and/or application may now require the user atPC 105 to consent to downloading and running executable security module125 (i.e., hostage.exe).

FIG. 2 is an illustration of an exemplary security graphical userinterface (GUI) of the invention, generally denoted by reference numeral200. The GUI 200 illustratively employs a Microsoft Internet Explorer®.browser which conveys precondition terms 205, or multiple sets ofconditions, for granting access to the login page of an application. Theprecondition terms includes approval for running an executable module(i.e., hostage.exe) digitally signed by the application owner. The GUI200 is meant to be illustrative; hence, any appropriate wording, in anylanguage, which conveys the intent of the precondition terms andsecurity process, may be used. If the user agrees by clicking the “Yes”button 210, hostage.exe collects various pieces of information which mayinclude network, software or hardware related information, as describedmore fully below, for transmission to the application owner or agent.The user may also elect to choose the “No” button 215 or to simplycancel the operation by choosing the “Cancel” button 220. If either the“No” or “Cancel” button is chosen, the application does not provide alogin screen, denying access to the application.

Legitimate users of a network application should not have any issues orconcerns with approving the execution of the security module.Non-legitimate users may decline to proceed or choose to proceed withrisk of detection.

FIG. 3 is a flow diagram showing an embodiment of steps of using theinvention beginning at step 300. FIGS. 3 and 4 may equally represent ahigh-level block diagram of components of the invention implementing thesteps thereof. The steps of FIGS. 3 and 4 may be implemented on computerprogram code in combination with the appropriate hardware. This computerprogram code may be stored on storage media such as a diskette, harddisk, CD-ROM, DVD-ROM or tape, as well as a memory storage device orcollection of memory storage devices such as read-only memory (ROM) orrandom access memory (RAM). Additionally, the computer program code canbe transferred to a workstation over the Internet or some other type ofnetwork

Continuing with FIG. 3, at step 305, a user may attempt to login to anetwork application. At step 310, a prompt with preconditions may bepresented to the user, perhaps as a GUI, that requests approval todownload and execute a security application. At step 315, a check ismade whether the approval has been provided by the user. If not, at step340, the process ends without performing the security check orproceeding with the application login sequence. This effectively deniesaccess to the application by the user.

If, however, approval is received, then at step 320, the securityapplication may be downloaded from a network server to the user'scomputer. At step 325, the security application executes and collectsvarious attributes that may be associated with the computer. Theseattributes, when assessed as a composite, may provide a uniquedescription of the user's computer. Often, no two computers have exactlythe same attributes or configurations. This configuration informationmay include any readable or detectable setting, device, assignment,version, component or data element that may be present or associatedwith the computer. This may also include hardware and softwareconfigurations available from the operating system registry, e.g.,Windows®. Registry which may, for example, include information fromHARDWARE, SOFTWARE and SYSTEM subtrees under HKEY_LOCAL_MACHINE. Also,operating system IDs such as Windows® product ID from the Registry:HKEYLOCAL_MACHINE-SOFTWARE-Microsoft-Windows-Product ID may also becollected. Also collected may be any of the following Windows® IPconfiguration data for the computer as return by, for example,“ipconfig/all command”:

(i) Host name,

(ii) Primary directory name service (DNS) suffix, and

(iii) for every Ethernet adapter in the computer:

Any connection-specific DNS suffix,

Any description of the adapter,

Any physical Address of the adapter,

Any IP address of the adapter,

Any subnet mask assigned to the adapter,

Any default gateway assigned to the adapter,

Any Dynamic Host Configuration Protocol DHCP Server(s) assigned to theadapter, and

Any Directory Number Service (DNS) Server(s) assigned to the adapter.

At step 330, the collected information may be returned to theapplication server or other designated destination for cataloging andstorage in a database with a date stamp of the security check. At step335, once the computer information has been collected, a login screenmay be presented to the user to proceed with typical login procedures(e.g., userID and password authentication) for the requestedapplication.

FIG. 4 is a flow diagram of an embodiment showing steps of using theinvention, beginning at step 400. At step 405, a screen presenting termsand conditions of gaining access to an application may be presented to auser. The conditions may stipulate that certain attributes andconfigurations of the user's computer may be acquired and sent to theapplication's owner or representative. The conditions, when accepted,establish an agreement between the user of the computer and theapplication owner or agent that the user's computer may be searched andinformation gathered and maintained concerning the configuration of theuser's computer. At step 410, upon agreement or approval of the termsand conditions, a security application module may be downloaded andexecuted at the user's computer. The security module executes andgathers configuration information of various types that may be presentin or associated with the user's computer for establishing a“computer-print” (analogous to a fingerprint to identify a person). Thisconfiguration information, when captured and stored, may be subsequentlyused, when necessary, to assist in proving or demonstrating that thisparticular computer was likely to have been involved in a certainactivity (e.g., an attack on another system/application or performedsome other action) during a particular time period.

At step 415, a check may be made as to whether a modem is configured onthe user's computer. If so, then at step 418, the security moduleattempts to dial a pre-determined number, for example “800,” “877,”“866,” “900,” or other pre-determined number. When the call issuccessfully placed and answered at a corresponding security callreception application also provided by the invention, such as anapplication running on server 115 or other location as determined by theapplication service provider, any received caller-ID information (i.e.,as commonly provided by the telephone network to the called party)associated with the telephone line used by the modem in computer 105, isassociated with the security module instance running at the usercomputer 105 and stored. This caller-ID reference information iscorrelated, time stamped and stored for later retrieval, as necessary.This caller-ID information may typically provide physical locationinformation (e.g., from records of the telephone company) of the user'scomputer 105. If the modem call is successful or if the modem callcannot be established, processing continues with step 420.

If, however, there is no modem, or the call is successfully placed, thenat step 420, the user's computer configuration information may becaptured for composing a “computer-print” of the user's computer forlater identification of the computer, if necessary. This configurationinformation may include, for example, any Host information and/orprimary DNS information which may reflect assignments (potentiallyunique at least to a certain degree) that this computer may have. Atstep 425, configuration and parameter information associated with everyEthernet adapter may be captured as part of the configurationinformation. This may include for each Ethernet adapter any assignedconnection-specific DNS suffixes, physical addresses, subnet masks,gateway defaults, DHCP and DNS servers, or the like.

At step 430, a route to a host on the Internet may be captured as partof the configuration information. Route data may provide, at least to acertain degree, unique identification of the user's computer. Forexample, if it can be demonstrated that the route data captured during asecurity check is the same route information of a computer involved in alater investigation, then it may be possible to establish that the samecomputer was involved in both situations.

Further, any IP addresses, such as returned by a tracert-d command, maybe captured as part of the configuration information and may includeaddresses to routers and/or addresses that may be within private IPranges (e.g., 10.0.0.1; 192.168.1.1; or 172.16.1.1). This IP addressinformation may be in use by an enterprise or other Internet ServiceProviders (ISP) and may provide additional unique configurationinformation regarding the user's network topology.

At step 435, registry information on the user's computer may be acquiredsuch as Windows® Registry and SYSTEM subtrees (e.g., underHKey_Local_machine) to be included as part of the configurationinformation. At step 440, any hardware (e.g., central processing unit(CPU), disk, compact disk (CD), DVD, memory, modem, I/O, hardwareelement versions, or the like) or peripherals and softwareconfigurations (e.g., applications, drivers, browsers, directorystructure, versions of software components, or the like) may be capturedfor inclusion in the configuration information, including any versioninformation or manufacturer's ID. At step 445, information related tooperating system product information and associated libraries may becaptured as part of the configuration information.

At step 450, the security module may create and store on the user'scomputer a “cookie” or similar marker to record the date and time of thesecurity scrutiny process. The cookie may be uniquely created foridentifying a particular security check episode, and may include adigital signature of the application owner launching the security check.At step 455, the gathered security information (e.g. configurationinformation) may be encrypted, and optionally digitally signed with asignature of the application owner and transmitted to a server,application, or proxy application for possible correlation with anymodem generated data, and cataloging for later recall if an attacksubsequently occurs.

At optional step 460, the gathered security information (i.e.,configuration information) may be retrieved and correlated to an attackincident (or other similar incident) and asserted against a possibleattacker, as appropriate. At step 465, a subsequent security check maybe performed on a suspect computer to obtain subsequent configurationdata in order to match the retrieved information (i.e., informationpreviously stored by an earlier security check) with the subsequentgathered configuration information data to establish a correlation andprobability that the two sets of configuration data are derived from thesame computer. This may involve matching corresponding portions of theconfiguration data from the two sets of data. A higher degree ofconfidence may be achieved as more portions of the two sets of data arematched, indicating that the two sets of data are likely from the samecomputer. This evidence may be used as necessary to enforce legalrights, or the like. The process exits at step 470.

While the invention has been described in terms of embodiments, thoseskilled in the art will recognize that the invention can be practicedwith modifications and in the spirit and scope of the appended claims.

1. A computer program product comprising a computer usable storage medium having readable program code embodied in the computer usable storage medium, the computer program product includes at least one component to: process a login to an application only after capturing a plurality of configuration data of a computer performing the login; recall the plurality of configuration data from a memory; and match at least portions of the recalled plurality of configuration data to corresponding portions of subsequent captured configuration data of a suspect computer which is a possible attacker of the network, to establish whether the recalled plurality of configuration data and the subsequent captured configuration data are both derived from the computer, wherein when the matching occurs, the computer is verified as possibly attacking the network and, wherein the plurality of configuration data comprises at least: (i) computer configuration information; (ii) Ethernet information associated with one or more Ethernet adapters; (iii) registry information; (iv) hardware configuration information; (v) software configuration information comprising a software component identification, a browser configuration, a software component version, a driver version, an application identification and directory structure; and (vi) operating system product information and associated libraries.
 2. The computer program product of claim 1, wherein the at least one component is operable to: receive an approval of at least one condition; download a security module to the computer based on receiving the approval; and execute the security module on the computer to gather the configuration data.
 3. The computer program product of claim 1, wherein the at least one component is operable to: transmit the configuration data to a server for storing; and provide a login screen for logging into the application after capturing the configuration data.
 4. The computer program product of claim 1, wherein the at least one component is operable to capture the subsequent captured configuration data from a suspect computer for use in determining whether the suspect computer and the computer are the same computer.
 5. The computer program product of claim 1, wherein an attempt to login is one of a successful login and an unsuccessful login.
 6. The computer program product of claim 1, wherein the at least one component is operable to: dial a call to a predetermined number using a modem associated with the computer; capture caller identification (caller-ID) information associated with the call; and correlate the caller-ID information with the configuration data for use in establishing an identity of the computer.
 7. The computer program product of claim 1, wherein the at least one component is operable to: provide at least one condition prior to an attempt to login to the application; capture the plurality of configuration data of the computer after receiving and displaying the at least one condition; and store the plurality of configuration data of the computer for subsequent recall when required to identify the computer attempting the login.
 8. The computer program product of claim 7, wherein the capturing further includes at least any one of: determine a route to a host server; and acquire software configuration information.
 9. The computer program product of claim 8, wherein the computer configuration information includes at least any one of a host name and a primary directory name service (DNS) suffix.
 10. The computer program product of claim 8, wherein the acquiring registry information step includes acquiring configurations from hardware, software and system subtrees.
 11. The computer program product of claim 8, wherein the acquiring hardware configuration acquires hardware information for at least any one of a central processing unit (CPU), memory, a compact disk, a DVD, a modem, hardware element version, and an I/O port, and wherein the acquiring software configuration acquires at least any one of a software component identification, a browser configuration, a software component version, a driver version, an application identification and directory structure.
 12. The computer program product of claim 1, wherein the at least one component is operable to deposit a marker on the computer to mark that an instance of a security check has occurred.
 13. The method of claim 1, wherein the at least one component is operable to access a stored configuration data when an incident has been identified requiring identification of the computer.
 14. A computer program product comprising a computer usable storage medium having readable program code embodied in the computer usable storage medium, the computer program product includes at least one component to: process a login to an application only after capturing a plurality of configuration data of a computer performing the login; recall the plurality of configuration data from a memory; match at least portions of the recalled plurality of configuration data to corresponding portions of subsequent captured configuration data of a suspect computer which is a possible attacker of the network, to establish whether the recalled plurality of configuration data and the subsequent captured configuration data are both derived from the computer, wherein when the matching occurs, the computer is verified as possibly attacking the network, and wherein the plurality of configuration data comprises at least: (i) computer configuration information; (ii) Ethernet information associated with one or more Ethernet adapters; (iii) registry information; and (iv) hardware configuration information; provide at least one condition prior to an attempt to login to the application; capture the plurality of configuration data of the computer after receiving and displaying the at least one condition; and store the plurality of configuration data of the computer for subsequent recall when required to identify the computer attempting the login, wherein the capturing further includes at least any one of: determining a route to a host server; and acquiring software configuration information, and wherein the Ethernet information includes: (i) a connection-specific DNS suffix, (ii) description of any Ethernet connection, (iii) a physical address of any Ethernet adapter, (iv) an Internet Protocol (IP) address of any Ethernet adapter, (v) a subnet mask assigned to any Ethernet adapter, (vi) a default gateway assigned to any Ethernet adapter, (vii) a DNS server assigned to any Ethernet adapter, and (viii) a dynamic host configuration protocol (DHCP) server assigned to any Ethernet adapter.
 15. A computer comprising: a CPU, a computer readable memory and a computer readable storage media; program instructions to process a login to an application only after capturing a plurality of configuration data of a computer performing the login; program instructions to recall the plurality of configuration data; program instructions to match at least portions of the recalled plurality of configuration data to corresponding portions of subsequent captured configuration data of a suspect computer which is a possible attacker of a network, to establish whether the recalled plurality of configuration data and the subsequent captured configuration data are both derived from the computer, wherein when the matching occurs, the computer is verified as possibly attacking the network; and program instructions to provide a security module to the computer based on receiving an approval of at least one condition, which executes on the computer to gather and send the plurality of configuration data, the plurality of configuration data comprises: (i) computer configuration information; (ii) Ethernet information associated with one or more Ethernet adapters; (iii) registry information; (iv) hardware configuration information; (v) software configuration information comprising a software component identification, a browser configuration, a software component version, a driver version, an application identification and directory structure; and (vi) operating system product information and associated libraries, wherein the program instructions are stored on the computer readable storage media for execution by the CPU. 